Atlas-Centaur

A Centaur stage during assembly at General Dynamics in 1962

Diagram of a Centaur stage

Centaur was the first rocket stage to utilize liquid hydrogen (LH2) and liquid oxygen (LOX) as propellants. Despite boasting high performance, LH2 had to be chilled to extremely low temperatures (lower than LOX) and its low density meant that large fuel tanks were needed.

The first attempt at using an LH2/LOX-fueled engine was the U.S. Air Force's top-secret Lockheed CL-400 Suntan reconnaissance aircraft program in the mid-1950s. The progress made during the aborted venture was picked up by Convair and others for rocket stage use. Originally, Centaur was conceived of as a purely experimental project to develop an experience for larger, more powerful rocket stages so as not to distract Convair's focus on the all-important SM-65 Atlas missile program.

Convair developed a specially-enhanced version of the Atlas D vehicle for mating with Centaur stages; the Atlas was equipped with an uprated booster section, the MA-5, which had twin turbopumps on each booster engine, and the structure reinforced for the large upper stage, along with elongated fuel tanks. Centaur development was made somewhat difficult by the insistence on modifying Atlas components rather than developing totally new ones. This was done for time and budget reasons and because it allowed the Centaur to be manufactured on the existing Atlas assembly line at Convair. The engines were manufactured by Pratt & Whitney.

Although originally under ARPA supervision, Centaur was transferred to NASA in July 1959, eleven months after the program's inception. However, the Air Force retained overall supervision in part because they intended to use Centaur to launch a network of military communications satellites known as ADVENT. A constellation of ten satellites would provide round-the-clock instant communications for the three main branches of the US military. The first three would be launched on an Atlas-Agena, then the remainder on Centaur. ADVENT never got off the drawing board, but Centaur quickly found a use for several NASA planetary probe projects, namely Mariner and Surveyor.

An initial lack of funds caused the project to drag on far longer than intended. Under original timetables, Centaur was to make its first flight in January 1961.

In October 1961, the first Atlas-Centaur (Vehicle Flight-1: Atlas 104D and Centaur F-1) arrived at Cape Canaveral and was erected at the newly completed and specifically built LC-36A. Technical problems caused the vehicle to sit on the launch pad for seven months, the most serious being leakage of liquid hydrogen through the intermediate bulkhead separating the propellant tanks combined with numerous lesser maladies with the guidance and propulsion systems.

The vehicle was launched at 2:49 PM EST (18:49 GMT) on 8 May 1962, with the intention of performing a single burn with a partially fueled Centaur. Slightly under a minute into the launch, the Centaur stage ruptured and disintegrated, taking the Atlas with it in a matter of seconds. It was unclear what had caused the failure at first, as tracking camera footage merely showed a large white cloud enveloping the booster followed by the explosion of the entire launch vehicle. Initial assumptions were that Atlas had suffered a LOX tank failure, either from a pressurization problem, rupture of the tank from flying debris, or structural bending/aerodynamic issues caused by the unproven Atlas-Centaur combination, and indeed there had been several previous occurrences of these failure modes on Atlas launches. Scott Carpenter's Mercury flight was only days away, and if the failure were caused by the Atlas, it could mean significant delays for that mission, which used a similar Atlas D derived Atlas LV-3B booster. However, analysis of telemetry data and closer examination of the launch films quickly confirmed the Centaur as the source of trouble.

The failure was determined to be caused by an insulation panel that ripped off the Centaur during ascent, resulting in a surge in tank pressure when the LH2 overheated. Beginning at T+44 seconds, the pneumatic system responded by venting propellant to reduce pressure levels, but eventually, they exceeded the LH2 tank's structural strength. At T+54 seconds, the Centaur experienced total structural breakup and loss of telemetry, the LOX tank rupturing and producing an explosion as it mixed with the hydrogen cloud. Two seconds later, flying debris ruptured the Atlas's LOX tank followed by complete destruction of the launch vehicle. The panel had been meant to jettison at 49 miles (80 km) up when the air was thinner, but the mechanism holding it in place was designed inadequately, leading to premature separation. The insulation panels had already been suspected during Centaur development of being a potential problem area, and the possibility of an LH2 tank rupture was considered as a failure scenario. Testing was suspended while efforts were made to correct the Centaur's design flaws.

A Congressional investigation in June 1962 called the overall management of the Centaur program "weak", and Wernher von Braun recommended that it be cancelled in favor of a Saturn I with an Agena upper stage for planetary missions.

In addition, the production Centaur stage had less lift capacity than originally planned, leading to ARPA cancelling Project ADVENT. NASA transferred Centaur development from MSFC to the Lewis Research Center in Ohio where a team headed by Abe Silverstein worked to correct the insulation panel problems and various other design flaws.[1]

In November 1962, President Kennedy suggested cancelling Centaur entirely, but was talked out of it on the grounds that the experience gained with liquid hydrogen rocket engines was vital to the success of the Apollo program. In addition, von Braun now proposed the Saturn-Agena be ruled out for cost reasons – Saturn was much too expensive to justify as a launch vehicle for small uncrewed probes. Agena was proving to be a reliability nightmare in both Air Force and NASA programs.

Eight Atlas-Centaur test missions were scheduled to be completed by the end of 1964, followed by the first Surveyor program launch. Centaur was upgraded to a high priority project because of this direct relation to Apollo.[2]

Meanwhile, the Department of Defense (DoD) had settled on the Titan family for its heavy-lift launching needs and so the Atlas-Centaur would remain a civilian launch vehicle used by NASA to fly scientific and commercial payloads. A conflict between the Air Force, who had primary oversight of the Atlas, and NASA also existed as the Centaur stage required various modifications to the basic Atlas. By 1962, the Air Force had considered the Atlas fully developed and operational and was against any further significant changes to it which might potentially jeopardize the ICBM program. The dispute was ultimately resolved by NASA agreeing to purchase standard Atlas D vehicles which could be custom-modified for Centaur launches. However, when the Atlas ICBM program ended in 1965, Convair replaced all of the earlier variants with a standardized booster for all space launches.

More than a year later, on 27 November 1963 at 19:03:23 GMT, AC-2 (Atlas 126D and Centaur stage #2) took place five days after President Kennedy's assassination. The redesigned Centaur stage functioned without any problems and performed a single burn to geostationary transfer orbit (GTO) (orbit of 474 x 1586 km, inclination of 30.4° and period of 105.8 minutes), where it remains in 2021. The insulation panels were permanently attached to the stage as the jettison problem had still not been solved. Vibration data proved that the panels would have prematurely detached had they not been bolted down. The ultimate fix to the panel problem added more dry mass to Centaur, further dropping its payload capacity. This Atlas-Centaur 2 launch vehicle was used for performance and structural integrity tests. It carried a payload of 4621 kg and instrumented with 907 kg of sensors, equipment, and telemetry.[3]

The AC-3 flight (Atlas 135D and Centaur #3) was launched on 30 June 1964 at 14:04:22 GMT with a payload of 4815 kg. Atlas performance was close to nominal with the sustainer running slightly LOX-rich for the first 70 seconds of flight and the trajectory being more lofted than expected. Insulation panel and payload shroud jettisons were tested for the first time. Following Centaur staging and engine start, the number two (C-2) engine began to lose roll control. The C-1 engine was able to compensate for a time, but the Centaur eventually lost control and began tumbling. Premature engine shutdown due to propellant starvation occurred at T+496 seconds, and the Centaur impacted in the South Atlantic. Postflight investigation traced the malfunction to a failure of the Centaur-2 engine hydraulic gimbal actuator.[4]

The AC-4 flight (Atlas 146D and Centaur #4) was launched on 11 December 1964 at 14:25:02 GMT with a payload of 2993 kg (that carried a mass model of the Surveyor spacecraft). It performed propulsion and stage separation tests,[5] following two scrubbed attempts due to bad weather. The guidance system was operated closed-loop for the first time and an attempt was made to recover the payload shroud, which was equipped with a balloon designed to release green marker dye into the ocean. The shroud was sighted by recovery crews but sank into the ocean and could not be located. The Atlas phase of the flight and the initial phase of Centaur flight were uneventful. The mission went awry when the Centaur could not be restarted due to an ill-conceived design modification — the ullage rockets were reduced in size to save weight, however, they proved insufficient to settle the propellants in the tanks. Subsequently, venting hydrogen caused the vehicle to tumble out of control. After ten orbits, the Centaur reentered over the South Pacific, on 12 December 1964.[6]

The AC-5 flight (Atlas 156D) on 2 March 1965 at 13:25 GMT from Cape Kennedy in a highly elliptical orbit, with a payload (Surveyor SD-1) of 951 kg, was only intended to carry out a single burn of the Centaur C, and program officials felt confident. This mission was designed to rehearse a complete Centaur upper stage burn in support of the Surveyor lunar lander program. On a nominal mission, the Centaur would boost its payload on a direct ascent trajectory to the Moon. On this test flight, NASA planned to deliver the payload, a non-functional dynamic model known as SD-1, into an orbit of 167 × 926.625 km that simulated a lunar transfer trajectory.

The flight quickly ended in disaster as the Atlas's booster engines shut down after a few feet of vehicle rise and the rocket fell back onto LC-36A and exploded, the Centaur's LH2 load going off in a huge fireball for the biggest on-pad explosion yet seen at Cape Canaveral.[7] However, this was also the first Atlas-Centaur equipped with the uprated 165,000 lb (75,000 kg) thrust MA-5 booster engines after the previous testing on two Atlas-Agena flights. The damage to LC-36A was not as severe as it looked and repairs were largely completed in three months, but the completion of LC-36B was also accelerated. Most damages were thermal rather than structural, and the upper portion of the umbilical tower, which was in the center of the LH2 blast, had been subjected to temperatures of 3315 °C.[1] The accident marked the first failure of an Atlas booster in a space launch since Midas 8 in June 1963, a new record at the time of 26 consecutive flights with only malfunctions of the upper stages or payload. This would be the last on-pad explosion at Cape Canaveral until 2016 (SpaceX Falcon 9 pre-flight mishap).

Post-flight investigation examined several possible reasons for the booster engine shutdown, including an accidental closure of the booster fuel staging disconnect valve, an open fuel fill/drain valve, or an accidental BECO signal. These failure modes were quickly ruled out and attention quickly centered on closure of the booster fuel prevalves. The low-pressure booster fuel ducting was found to have collapsed from a sudden loss of fuel flow, but had not ruptured. The investigation concluded that the fuel prevalves had only opened partially and the propellant flow was enough to push them shut, starving the booster engines of RP-1 and causing a LOX-rich shutdown. Engine start had proceeded normally and all booster systems functioned properly until the valve closed. Booster shutdown occurred at T+1.7 seconds and the vehicle impacted on the pad at T+2.8 seconds. Bench testing confirmed that there were several possible ways that the valve would only open partially, although the exact reason was not determined. This failure mode had never occurred in the 240 Atlas launches prior to AC-5 despite always having been possible.

Until a more permanent solution could be found, a temporary fix was made for Atlas-Agena vehicles by equipping the valve with a manual lock that would be enabled during the pre-launch countdown. A manual E-series sustainer prevalve was also installed as a precautionary measure in addition, an unrelated system malfunction in AC-5 was discovered when an examination of telemetry data found that a power failure had occurred in the guidance computer. As a temporary fix for Atlas-Centaur AC-6, 7, and 8, several unused components were removed from the computer in order to reduce system complexity and failure points.[8]

The failure of AC-5 resulted in another Congressional investigation, again headed by Rep. Joseph Karth, who argued that US$600 million of taxpayer money had been spent on Centaur so far with little to show for it and that Convair was taking advantage of being the sole supplier of the Atlas-Centaur vehicle. The committee proposed that NASA consider alternate choices for the planetary probe program, such as Titan IIIC, or outsource the manufacture of Centaur to other contractors. However, NASA representatives argued that this was impossible as no other aerospace company had the experience or technical capability to manufacture the Centaur's balloon tanks.

On 20 February 1975, AC-33 launched carrying the Intelsat IV F-6 communications satellite. The flight went entirely according to plan up until BECO at T+140 seconds. During booster separation, a swivel lanyard designed to pull out an electrical plug supplying power to the booster section failed to detach, causing a voltage spike that reset the Atlas's guidance computer. The booster drifted off its flight path as a result. SECO was effected on time at T+401 seconds followed by Centaur separation and engine start, but it had become clear that the trajectory would take it into the Atlantic Ocean instead of orbit, and so the Range Safety Officer (RSO) sent the destruct command at T+413 seconds. Investigation showed that the lanyard was not only inadequately designed, but it also was an off-the-shelf component designed for marine equipment and not rockets or aircraft. The lanyard had been noted as a potential problem as early as 1967 and although fixes were made to some Atlas SLVs as well as Atlas E/F series missiles, there was no across-the-board effort to replace them with a more suitable component. The backup Intelsat (Intelsat IV F-1) was launched successfully on AC-35 in May 1975.

Two years later, on 29 September 1977, another attempted launch of an Intelsat (Intelsat IVA F-5) communications satellite took place on AC-43. Shortly after liftoff, abnormal temperatures were detected in the Atlas's thrust section and continued to rise as the booster ascended. A visible thrust section fire could be seen starting at T+33 seconds and sustainer thrust vector control hydraulic pressure was lost at T+55 seconds, causing total loss of vehicle control. The payload fairing and satellite were stripped from the booster, followed by the Atlas exploding as the thrust section fire touched off the propellant tanks at T+60 seconds. The Centaur flew free until being destructed by the Range Safety Officer a few seconds later. NASA and U.S. Air Force officials, already busy investigating the launch failure of a Delta booster three weeks earlier (OTS-1), dredged the Atlas's engines from the ocean floor and sent them to Convair for examination. It was concluded that a gas generator leak caused by improper brazing of a pipe led to overheating and fire in the thrust section of the Atlas. The pipe also suffered corrosion from six years of sitting in a warehouse in the salty air along the Florida coast and the damage was in an area not visible during a preflight examination. The Atlas used on this flight had been delivered to the Cape in 1971 and kept in storage since then, an unusually long time. In the aftermath of the accident, NASA inspected their inventory of Atlas vehicles and found several more improperly brazed pipes which needed replacement.

On 26 March 1987, AC-67 failed to launch a Navy FLTSATCOM satellite. Weather conditions were poor that day, with thick clouds and "moderate to heavy" precipitation. The weather conditions violated one launch criteria ("The flight path of the vehicle should not be through mid level clouds 6,000 feet or greater in depth, when the freezing level is in the clouds."), the weather team reported it as an icing issue, not a lightning risk. After discussions about the risk posed by ice, the NASA program directors gave the go-ahead. The Atlas was struck by lightning around 48 seconds into launch. Control of the booster started to fail and it broke apart from structural loads at T+50 seconds. The Range Safety Officer sent the destruct command, but there was no evidence that the booster ever received it. Debris rained out of the clouds onto the pad area, the shoreline, or in shallow water just off of it and was easily recovered. A section of the payload fairing was found to have multiple small holes burned in it due to repeated lightning strikes. The key piece of evidence was Atlas's flight computer, which was recovered intact and examined. It was discovered that the last command issued was a signal to gimbal the booster engines hard to right, caused apparently by lightning induced Electromagnetic pulse (EMP) altering a single word in the guidance program.[14][15]

The launch caused significant reappraisals of weather guidelines at Cape Canaveral. The 45th Weather Squadron uses rules developed after the incident to determine if weather conditions allow a launch.[16]